Critical severity · published May 3, 2019
CVE-2019-11037
In PHP imagick extension in versions between 3.3.0 and 3.4.4, writing to an array of values in ImagickKernel::fromMatrix() function did not check that the address will be within…
9.8
CVSS
2%
EPSS
No
On KEV
Description
In PHP imagick extension in versions between 3.3.0 and 3.4.4, writing to an array of values in ImagickKernel::fromMatrix() function did not check that the address will be within the allocated array. This could lead to out of bounds write to memory if the function is called with the data controlled by untrusted party.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Imagick · Php
3.3.0 through 3.4.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-11037
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-11037
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00016.html
www.securityfocus.com
http://www.securityfocus.com/bid/108292
Mailing List
https://bugs.php.net/bug.php?id=77791
github.com
https://github.com/CVEProject/cvelist/pull/1964
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MQ7WJA25YF2R2LRALK4QEYWUHHJPSUD/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BU66V7QJKD32RXLY5J7Z5NZH4V3VV524/